exim.git
3 years agodeliver
Heiko Schlittermann (HS12-RIPE) [Sat, 3 Apr 2021 08:54:22 +0000 (10:54 +0200)]
deliver

(cherry picked from commit 2bafe3fc82cf62f0c21f939f5891b8d067f3abc7)

3 years agorf_get_transport
Heiko Schlittermann (HS12-RIPE) [Fri, 2 Apr 2021 06:36:24 +0000 (08:36 +0200)]
rf_get_transport

(cherry picked from commit 015fff57c854184f8bce61476c46a2830a97daf8)

3 years agolf_sqlperform
Heiko Schlittermann (HS12-RIPE) [Thu, 1 Apr 2021 19:36:12 +0000 (21:36 +0200)]
lf_sqlperform

(cherry picked from commit 9810dfc25d8b9687b46e57963a3ac30bf5c9b2c9)

3 years agoexpand
Heiko Schlittermann (HS12-RIPE) [Thu, 1 Apr 2021 19:33:50 +0000 (21:33 +0200)]
expand

(cherry picked from commit c02ea85f525ff256d78e084d6f76fe3032fd52e1)

3 years agodirectory
Heiko Schlittermann (HS12-RIPE) [Thu, 1 Apr 2021 19:28:59 +0000 (21:28 +0200)]
directory

(cherry picked from commit 5f41e800ce9cc7ad154047298914df955e905bf4)

3 years agodeliver
Heiko Schlittermann (HS12-RIPE) [Wed, 31 Mar 2021 21:12:44 +0000 (23:12 +0200)]
deliver

(cherry picked from commit 2fee91ae42e974c21202e0b5e17185f6a87bf8af)

3 years agopipe
Heiko Schlittermann (HS12-RIPE) [Fri, 2 Apr 2021 15:30:27 +0000 (17:30 +0200)]
pipe

(cherry picked from commit f9628406706112be459adb3f121db8e6cf282c2d)

3 years agoautoreply
Heiko Schlittermann (HS12-RIPE) [Sun, 28 Mar 2021 09:06:27 +0000 (11:06 +0200)]
autoreply

(cherry picked from commit 26de37d8960da80473866fb59b9dfd10a5761538)

3 years agorda
Heiko Schlittermann (HS12-RIPE) [Sun, 28 Mar 2021 08:59:46 +0000 (10:59 +0200)]
rda

(cherry picked from commit a6da9c67acaee699616516be141d600cc178a633)

3 years agoparse
Heiko Schlittermann (HS12-RIPE) [Sun, 28 Mar 2021 08:58:46 +0000 (10:58 +0200)]
parse

(cherry picked from commit 7eeeb6f26af05322814ecc77c87f09c72ab2216a)

3 years agoacl
Heiko Schlittermann (HS12-RIPE) [Sun, 28 Mar 2021 08:50:14 +0000 (10:50 +0200)]
acl

(cherry picked from commit 44fd80ad8abcd885fc1c8dbb294fc2140e4ef481)

3 years agodbstuff
Heiko Schlittermann (HS12-RIPE) [Sun, 28 Mar 2021 08:49:49 +0000 (10:49 +0200)]
dbstuff

(cherry picked from commit 35b11dd0e52b5ac176849f807cca8898bcaf0c3d)

3 years agosearch
Heiko Schlittermann (HS12-RIPE) [Thu, 1 Apr 2021 20:45:03 +0000 (22:45 +0200)]
search

(cherry picked from commit b71d675f695c2cf17357b190476129535d5f446c)

3 years agoIntroduce main config option allow_insecure_tainted_data
Heiko Schlittermann (HS12-RIPE) [Thu, 1 Apr 2021 20:44:31 +0000 (22:44 +0200)]
Introduce main config option allow_insecure_tainted_data

This option is deprecated already now.

(cherry picked from commit ec06d64532e4952fc36429f73e0222d26997ef7c)

3 years agoGnuTLS: fix build with older GnuTLS
Jeremy Harris [Tue, 22 Jun 2021 22:42:24 +0000 (23:42 +0100)]
GnuTLS: fix build with older GnuTLS

The ALPN handling we need requires later features than the basic functions.
Broken-byu: f50a063dc0

3 years agoTLS: as server, reject connections with ALPN indicating non-smtp use
Jeremy Harris [Tue, 22 Jun 2021 22:04:59 +0000 (23:04 +0100)]
TLS: as server, reject connections with ALPN indicating non-smtp use

3 years agoTestsuite: fix testcases for non-TLS build
Jeremy Harris [Mon, 21 Jun 2021 19:39:37 +0000 (20:39 +0100)]
Testsuite: fix testcases for non-TLS build

3 years agoTestsuite: fix munging for no-TLS build
Jeremy Harris [Mon, 21 Jun 2021 19:22:23 +0000 (20:22 +0100)]
Testsuite: fix munging for no-TLS build

Broken-by: da40b1ec6b
3 years agoCompiler quietening
Jeremy Harris [Sun, 20 Jun 2021 13:20:32 +0000 (14:20 +0100)]
Compiler quietening

Stupid static analysis failing to track crontrol dependencies

3 years agoOpenSSL: on library versions too old to support session tickets
Jeremy Harris [Sat, 19 Jun 2021 19:12:09 +0000 (20:12 +0100)]
OpenSSL: on library versions too old to support session tickets
client-side limit the valid lifetime of resumable sessions

3 years agoTestsuite: split out OpenSSL TLS1.3 resume tests
Jeremy Harris [Sat, 19 Jun 2021 18:11:43 +0000 (19:11 +0100)]
Testsuite: split out OpenSSL TLS1.3 resume tests

Older library versions do not support 1.3 so a separate numbered
testcase is needed

3 years agoTestsuite: allow time for daemon to listen before terminating
Jeremy Harris [Sat, 19 Jun 2021 18:10:26 +0000 (19:10 +0100)]
Testsuite: allow time for daemon to listen before terminating

3 years agoOpenSSL: fix verify-certs stack initialization
Jeremy Harris [Thu, 17 Jun 2021 19:45:32 +0000 (20:45 +0100)]
OpenSSL: fix verify-certs stack initialization

3 years agoTestsuite: output changes for OpenSSL library variants
Jeremy Harris [Thu, 17 Jun 2021 18:50:08 +0000 (19:50 +0100)]
Testsuite: output changes for OpenSSL library variants

Broken-by: 2f8e0a5f6b
3 years agoDocs: typo
Jeremy Harris [Thu, 17 Jun 2021 18:44:19 +0000 (19:44 +0100)]
Docs: typo

3 years agohosts_require_helo
Jeremy Harris [Tue, 15 Jun 2021 18:27:04 +0000 (19:27 +0100)]
hosts_require_helo

3 years agoTestsuite: EC cert
Jeremy Harris [Sun, 13 Jun 2021 13:47:25 +0000 (14:47 +0100)]
Testsuite: EC cert

3 years agoFix server creds cache invalidation
Jeremy Harris [Tue, 8 Jun 2021 20:42:23 +0000 (21:42 +0100)]
Fix server creds cache invalidation

Broken-by: 5fd673807d
3 years agocompiler quietening
Jeremy Harris [Mon, 7 Jun 2021 18:13:09 +0000 (19:13 +0100)]
compiler quietening

3 years agoRe-fix non-Linux build
Jeremy Harris [Mon, 7 Jun 2021 17:47:14 +0000 (18:47 +0100)]
Re-fix non-Linux build

3 years agotidying
Jeremy Harris [Sun, 6 Jun 2021 21:23:03 +0000 (22:23 +0100)]
tidying

Vroken-by: ef77ddc923
3 years agoFix non-Linux build
Jeremy Harris [Sun, 6 Jun 2021 21:03:35 +0000 (22:03 +0100)]
Fix non-Linux build

3 years agoObservability: listen queue backlog
Jeremy Harris [Sun, 6 Jun 2021 18:58:48 +0000 (19:58 +0100)]
Observability: listen queue backlog

3 years agoTestsuite: testcase for multiple listener sockets ready
Jeremy Harris [Sun, 6 Jun 2021 16:01:02 +0000 (17:01 +0100)]
Testsuite: testcase for multiple listener sockets ready

3 years agoAvoid rescanning listen select set
Jeremy Harris [Sun, 6 Jun 2021 13:05:02 +0000 (14:05 +0100)]
Avoid rescanning listen select set

3 years agoCompute select fd_set outside daemon loop
Jeremy Harris [Sun, 6 Jun 2021 10:29:56 +0000 (11:29 +0100)]
Compute select fd_set outside daemon loop

3 years agoTestsuite: fix OCSP/OpenSSL/1.3 testcase
Jeremy Harris [Sat, 5 Jun 2021 20:30:38 +0000 (21:30 +0100)]
Testsuite: fix OCSP/OpenSSL/1.3 testcase

3 years agoFix SSL creds file watching on kevent platforms (BSDs) for symlinks
Jeremy Harris [Sat, 5 Jun 2021 19:47:12 +0000 (20:47 +0100)]
Fix SSL creds file watching on kevent platforms (BSDs) for symlinks

3 years agoDMARC: note unsupported library versions issue
Jeremy Harris [Fri, 4 Jun 2021 10:35:52 +0000 (11:35 +0100)]
DMARC: note unsupported library versions issue

3 years agodebug: fix openssl output
Jeremy Harris [Tue, 1 Jun 2021 19:51:42 +0000 (20:51 +0100)]
debug: fix openssl output

3 years agoTestsuite: regen certificates suite with fixed Authority Identifier
Jeremy Harris [Tue, 1 Jun 2021 20:20:38 +0000 (21:20 +0100)]
Testsuite: regen certificates suite with fixed Authority Identifier

3 years agoDKIM: under GnuTLS, permit weak algorithms
Jeremy Harris [Fri, 28 May 2021 19:04:44 +0000 (20:04 +0100)]
DKIM: under GnuTLS, permit weak algorithms

Recent versions of GnuTLS by default disallow use of some methods now regarded as
weak.  This probably mean sha1, which is deprecated per DKIM standards.

3 years agoTestsuite: use higher-spec certs, for more-recent GnuTLS versions which deprecate...
Jeremy Harris [Fri, 28 May 2021 16:33:13 +0000 (17:33 +0100)]
Testsuite: use higher-spec certs, for more-recent GnuTLS versions which deprecate weaker ones

Needed for GnuTLS 3.6.15 (on Fedora 33)

3 years agotidying
Jeremy Harris [Fri, 28 May 2021 14:13:29 +0000 (15:13 +0100)]
tidying

3 years agoUpdate testcase output to match newly applied default config limit
Jeremy Harris [Fri, 28 May 2021 13:55:43 +0000 (14:55 +0100)]
Update testcase output to match newly applied default config limit
Broken-by: f07847e436
3 years agoFix testsuite output for DB cases
Jeremy Harris [Fri, 28 May 2021 13:41:00 +0000 (14:41 +0100)]
Fix testsuite output for DB cases
Broken-by: 186e99bafc
3 years agotidying
Jeremy Harris [Fri, 28 May 2021 13:09:45 +0000 (14:09 +0100)]
tidying

3 years agoLogging: avoid pause during log-open under testsuite
Jeremy Harris [Fri, 28 May 2021 12:33:49 +0000 (13:33 +0100)]
Logging: avoid pause during log-open under testsuite
It results in rearranged logging output, causing testsuite case failures
The downside is that we lose debug visbility of the extra process startup

Broken-by: b6c1434e47
3 years agoFix dmarc build
Jeremy Harris [Fri, 28 May 2021 08:37:15 +0000 (09:37 +0100)]
Fix dmarc build
Broken-by: b6c1434e47
3 years agoDocs: enhance section on redirect router :defer: & :fail:
Jeremy Harris [Wed, 26 May 2021 12:41:13 +0000 (13:41 +0100)]
Docs: enhance section on redirect router :defer: & :fail:

3 years agoMerge branch 'qualys-2020'
Heiko Schlittermann (HS12-RIPE) [Thu, 27 May 2021 21:18:04 +0000 (23:18 +0200)]
Merge branch 'qualys-2020'

- all Qualys patches from 4.94.2
- all fixes from 4.94.2+fixes if not applied yet

3 years agoFix BDAT issue for body w/o trailing CRLF (again Bug 1974)
Heiko Schlittermann (HS12-RIPE) [Fri, 30 Apr 2021 08:47:45 +0000 (10:47 +0200)]
Fix BDAT issue for body w/o trailing CRLF (again Bug 1974)

(cherry picked from commit 919111edac911ba9c15422eafd7c5bf14d416d26)

3 years agotestsuite: reproduce BDAT with missing eol (Bug 1974)
Heiko Schlittermann (HS12-RIPE) [Thu, 29 Apr 2021 22:37:53 +0000 (00:37 +0200)]
testsuite: reproduce BDAT with missing eol (Bug 1974)

(cherry picked from commit e9cecc465a570c1a4f34b199eae6bdd0a52ee2b0)

3 years agoCleanup docs on cve-2020-qualys, point to the Exim website
Heiko Schlittermann (HS12-RIPE) [Mon, 26 Apr 2021 16:54:28 +0000 (18:54 +0200)]
Cleanup docs on cve-2020-qualys, point to the Exim website

(cherry picked from commit 6429b0fc79595f120703c022ae99aa10d698f909)

3 years agorewrite: revert to unchecked result of parse_extract_address()
Heiko Schlittermann (HS12-RIPE) [Mon, 26 Apr 2021 14:16:49 +0000 (16:16 +0200)]
rewrite: revert to unchecked result of parse_extract_address()

Now it breaks 471, and overlong addresses won't make it into the rewrite
process, as they are handled as empty.

(cherry picked from commit 506286c62b8786a926dafb5bb05d3103492b86bc)

3 years agoHonour the outcome of parse_extract_address(), testsuite 471
Heiko Schlittermann (HS12-RIPE) [Mon, 19 Apr 2021 20:23:14 +0000 (22:23 +0200)]
Honour the outcome of parse_extract_address(), testsuite 471

(cherry picked from commit 39d83bf19fc0c4364e0a665360b14194c62e4ab4)

3 years agoUpdate upgrade notes and source about use of seteuid()
Heiko Schlittermann (HS12-RIPE) [Wed, 21 Apr 2021 05:52:39 +0000 (07:52 +0200)]
Update upgrade notes and source about use of seteuid()

(cherry picked from commit bc13bbca6e07267dfe0c4d275bb0a2e9aabf1dfb)
(cherry picked from commit fee1a06ec05e58e0cda8cf04f28240688736f945)

3 years agoCVE-2020-28007: Link attack in Exim's log directory
Qualys Security Advisory [Tue, 23 Feb 2021 16:33:03 +0000 (08:33 -0800)]
CVE-2020-28007: Link attack in Exim's log directory

We patch this vulnerability by opening (instead of just creating) the
log file in an unprivileged (exim) child process, and by passing this
file descriptor back to the privileged (root) parent process. The two
functions log_send_fd() and log_recv_fd() are inspired by OpenSSH's
functions mm_send_fd() and mm_receive_fd(); thanks!

This patch also fixes:

- a NULL-pointer dereference in usr1_handler() (this signal handler is
  installed before process_log_path is initialized);

- a file-descriptor leak in dmarc_write_history_file() (two return paths
  did not close history_file_fd).

Note: the use of log_open_as_exim() in dmarc_write_history_file() should
be fine because the documentation explicitly states "Make sure the
directory of this file is writable by the user exim runs as."

(cherry picked from commit 2502cc41d1d92c1413eca6a4ba035c21162662bd)
(cherry picked from commit 93e9a18fbf09deb59bd133986f4c89aeb2d2d86a)

3 years agoCVE-2020-28016: Heap out-of-bounds write in parse_fix_phrase()
Heiko Schlittermann (HS12-RIPE) [Mon, 12 Apr 2021 21:05:44 +0000 (23:05 +0200)]
CVE-2020-28016: Heap out-of-bounds write in parse_fix_phrase()

Based on Phil Pennock's commit 76a1ce77.
Modified by Qualys.

(cherry picked from commit f218fef171cbe9e61d10f15399aab8fa6956535b)
(cherry picked from commit 8b1e9bc2cac17ee24d595c97dcf97d9b016f8a46)

3 years agoSECURITY: Avoid modification of constant data in dkim handling
Heiko Schlittermann (HS12-RIPE) [Tue, 30 Mar 2021 20:59:25 +0000 (22:59 +0200)]
SECURITY: Avoid modification of constant data in dkim handling

Based on Heiko Schlittermann's commits f880c7f3 and c118c7f4. This
fixes:

6/ In src/pdkim/pdkim.c, pdkim_update_ctx_bodyhash() is sometimes called
with a global orig_data and hence canon_data, and the following line can
therefore modify data that should be constant:

 773   canon_data->len = b->bodylength - b->signed_body_bytes;

For example, the following proof of concept sets lineending.len to 0
(this should not be possible):

(sleep 10; echo 'EHLO test'; sleep 3; echo 'MAIL FROM:<>'; sleep 3; echo 'RCPT TO:postmaster'; sleep 3; echo 'DATA'; date >&2; sleep 30; printf 'DKIM-Signature:a=rsa-sha1;c=simple/simple;l=0\r\n\r\n\r\nXXX\r\n.\r\n'; sleep 30) | nc -n -v 192.168.56.102 25

(gdb) print lineending
$1 = {data = 0x55e18035b2ad "\r\n", len = 2}
(gdb) print &lineending.len
$3 = (size_t *) 0x55e180385948 <lineending+8>
(gdb) watch *(size_t *) 0x55e180385948

Hardware watchpoint 1: *(size_t *) 0x55e180385948
Old value = 2
New value = 0
(gdb) print lineending
$5 = {data = 0x55e18035b2ad "\r\n", len = 0}

(cherry picked from commit 92359a62a0e31734ad8069c66f64b37f9eaaccbe)
(cherry picked from commit c5f2f5cf2a6b45ae7ba0ed15e04fbe014727b210)

3 years agoSECURITY: Leave a clean smtp_out input buffer even in case of read error
Heiko Schlittermann (HS12-RIPE) [Tue, 30 Mar 2021 20:48:06 +0000 (22:48 +0200)]
SECURITY: Leave a clean smtp_out input buffer even in case of read error

Based on Heiko Schlittermann's commit 54895bc3. This fixes:

7/ In src/smtp_out.c, read_response_line(), inblock->ptr is not updated
when -1 is returned. This does not seem to have bad consequences, but is
maybe not the intended behavior.

(cherry picked from commit 30f5d98786fb4e6ccfdd112fe65c153f0ee34c5f)
(cherry picked from commit d600f6c4d0c5d33e3988dfbfee248ff6a1536673)

3 years agoSECURITY: Always exit when LOG_PANIC_DIE is set
Qualys Security Advisory [Mon, 22 Feb 2021 06:09:06 +0000 (22:09 -0800)]
SECURITY: Always exit when LOG_PANIC_DIE is set

(cherry picked from commit e20aa895b37f449d5c81c3e7b102fc534b5d23ba)
(cherry picked from commit 3b8c0ceb7339329188e19efb907da950dbe691d1)

3 years agoCVE-2020-28012: Missing close-on-exec flag for privileged pipe
Qualys Security Advisory [Mon, 22 Feb 2021 05:53:55 +0000 (21:53 -0800)]
CVE-2020-28012: Missing close-on-exec flag for privileged pipe

(cherry picked from commit 72dad1e64bb3d1ff387938f59678098cab1f60a3)
(cherry picked from commit 645a31d16195bb6b73f0a0d0c04b2251e5b28421)

3 years agoCVE-2020-28024: Heap buffer underflow in smtp_ungetc()
Qualys Security Advisory [Mon, 22 Feb 2021 05:49:30 +0000 (21:49 -0800)]
CVE-2020-28024: Heap buffer underflow in smtp_ungetc()

(cherry picked from commit 998e5a9db121c3eff15cac16859bdffd7adcbe57)
(cherry picked from commit 638f7ca75694bcbb70cfbe7db2ef52af4aca5c83)

3 years agoCVE-2020-28009: Integer overflow in get_stdinput()
Qualys Security Advisory [Mon, 22 Feb 2021 05:45:19 +0000 (21:45 -0800)]
CVE-2020-28009: Integer overflow in get_stdinput()

(cherry picked from commit bbf1bb10bee5a1d7cbcc97f178b348189219eb7d)
(cherry picked from commit 1241deaefb71c40436320af7d0bd04c7c9e54241)

3 years agoCVE-2020-28015+28021: New-line injection into spool header file
Qualys Security Advisory [Mon, 22 Feb 2021 05:26:53 +0000 (21:26 -0800)]
CVE-2020-28015+28021: New-line injection into spool header file

(cherry picked from commit 31b1a42d0bd29cb05f85e56d3343b13bef20a2bd)
(cherry picked from commit fcddccd650178ceeec3655c6c40f420164a8706e)

3 years agoCVE-2020-28026: Line truncation and injection in spool_read_header()
Heiko Schlittermann (HS12-RIPE) [Tue, 30 Mar 2021 20:03:49 +0000 (22:03 +0200)]
CVE-2020-28026: Line truncation and injection in spool_read_header()

This also fixes:

2/ In src/spool_in.c:

 462   while (  (len = Ustrlen(big_buffer)) == big_buffer_size-1
 463         && big_buffer[len-1] != '\n'
 464         )
 465     {   /* buffer not big enough for line; certs make this possible */
 466     uschar * buf;
 467     if (big_buffer_size >= BIG_BUFFER_SIZE*4) goto SPOOL_READ_ERROR;
 468     buf = store_get_perm(big_buffer_size *= 2, FALSE);
 469     memcpy(buf, big_buffer, --len);

The --len in memcpy() chops off a useful byte (we know for sure that
big_buffer[len-1] is not a '\n' because we entered the while loop).

Based on a patch done by Qualys.

(cherry picked from commit f0c307458e1ee81abbe7ed2d4a8d16b5cbd8a799)
(cherry picked from commit 4daba4bec729a57fb0863af786a1395e70794c76)

3 years agoCVE-2020-28022: Heap out-of-bounds read and write in extract_option()
Heiko Schlittermann (HS12-RIPE) [Mon, 29 Mar 2021 21:12:02 +0000 (23:12 +0200)]
CVE-2020-28022: Heap out-of-bounds read and write in extract_option()

Based on Phil Pennock's commit c5017adf.

(cherry picked from commit 9e941e1807b624b255c9ec0f41a0b3a89e144de3)
(cherry picked from commit 33d4c87653ddbbea9fd8cb8eb2ff78c149850006)

3 years agoCVE-2020-28017: Integer overflow in receive_add_recipient()
Heiko Schlittermann (HS12-RIPE) [Mon, 29 Mar 2021 21:05:58 +0000 (23:05 +0200)]
CVE-2020-28017: Integer overflow in receive_add_recipient()

Based on Phil Pennock's commit e3b441f7.

(cherry picked from commit 18a19e18242edc5ab2082fa9c41cd6210d1b6087)
(cherry picked from commit 605716b999a4ca6c7d5777ab7463058e9b055dc2)

3 years agoSECURITY: Refuse negative and large store allocations
Heiko Schlittermann (HS12-RIPE) [Mon, 29 Mar 2021 21:02:34 +0000 (23:02 +0200)]
SECURITY: Refuse negative and large store allocations

Based on Phil Pennock's commits b34d3046 and e6c1606a.  Done by Qualys.

(cherry picked from commit 09d36bd64fc5bf71d8882af35c41ac4e8599acc1)
(cherry picked from commit f9c58fb385343b8e3fa13988efcbd30ae3285ea7)

3 years agoCVE-2020-28013: Heap buffer overflow in parse_fix_phrase()
Heiko Schlittermann (HS12-RIPE) [Mon, 29 Mar 2021 20:44:47 +0000 (22:44 +0200)]
CVE-2020-28013: Heap buffer overflow in parse_fix_phrase()

Based on Phil Pennock's 8a50c88a, done by Qualys

(cherry picked from commit 8161c16ec7320ac6164954bade23179a0ed095eb)
(cherry picked from commit 71585e8fcb8704a9f431f5a8d019280cccaad069)

3 years agoCVE-2020-28011: Heap buffer overflow in queue_run()
Qualys Security Advisory [Mon, 22 Feb 2021 03:22:33 +0000 (19:22 -0800)]
CVE-2020-28011: Heap buffer overflow in queue_run()

(cherry picked from commit 6e1fb878e95f8e6f838ffde5258c7a969c981865)
(cherry picked from commit 08102cbe8102f99b31655aa0e926c45b427efe6d)

3 years agoCVE-2020-28010: Heap out-of-bounds write in main()
Heiko Schlittermann (HS12-RIPE) [Mon, 29 Mar 2021 20:16:28 +0000 (22:16 +0200)]
CVE-2020-28010: Heap out-of-bounds write in main()

Based on Phil Pennock's 0f57feb4. Done by Qualys, modified by me.

(cherry picked from commit b0982c2776048948ebae48574b70fa487684cb8c)
(cherry picked from commit dbc3ab675c2e5e2a07ed13dc5ede4daa018600e7)

3 years agoCVE-2020-28018: Use-after-free in tls-openssl.c
Qualys Security Advisory [Mon, 22 Feb 2021 03:05:56 +0000 (19:05 -0800)]
CVE-2020-28018: Use-after-free in tls-openssl.c

(cherry picked from commit 6290686dd59d8158d100c67e8f96df27158a6fc5)
(cherry picked from commit a53a7fcfb8216764e4420d8d263356b4ed7d5cef)

3 years agoCVE-2020-28025: Heap out-of-bounds read in pdkim_finish_bodyhash()
Qualys Security Advisory [Mon, 22 Feb 2021 02:54:16 +0000 (18:54 -0800)]
CVE-2020-28025: Heap out-of-bounds read in pdkim_finish_bodyhash()

(cherry picked from commit cad30cd3fb96196e908e0d66b1b45fdf377c850c)
(cherry picked from commit 1c261b90f627f0489f7dfcf1e66b46cce67f477d)

3 years agoCVE-2020-28014, CVE-2021-27216: PID file handling
Heiko Schlittermann (HS12-RIPE) [Thu, 25 Mar 2021 21:48:09 +0000 (22:48 +0100)]
CVE-2020-28014, CVE-2021-27216: PID file handling

Arbitrary PID file creation, clobbering, and deletion.
Patch provided by Qualys.

(cherry picked from commit 974f32939a922512b27d9f0a8a1cb5dec60e7d37)
(cherry picked from commit 43c6f0b83200b7082353c50187ef75de3704580a)

3 years agoAdd priv.c: reworked version of priv dropping code
Heiko Schlittermann (HS12-RIPE) [Wed, 10 Mar 2021 22:37:29 +0000 (23:37 +0100)]
Add priv.c: reworked version of priv dropping code

(cherry picked from commit 82b545236e6dc82b7af34528c532811bfc74ea19)
(cherry picked from commit be31ef213f118abe5fc68732f5492b6b16d28b87)

3 years agoCVE-2020-28008: Assorted attacks in Exim's spool directory
Heiko Schlittermann (HS12-RIPE) [Sun, 14 Mar 2021 11:16:57 +0000 (12:16 +0100)]
CVE-2020-28008: Assorted attacks in Exim's spool directory

We patch dbfn_open() by introducing two functions priv_drop_temp() and
priv_restore() (inspired by OpenSSH's functions temporarily_use_uid()
and restore_uid()), which temporarily drop and restore root privileges
thanks to seteuid(). This goes against Exim's developers' wishes ("Exim
(the project) doesn't trust seteuid to work reliably") but, to the best
of our knowledge, seteuid() works everywhere and is the only way to
securely fix dbfn_open().

(cherry picked from commit 18da59151dbafa89be61c63580bdb295db36e374)
(cherry picked from commit b05dc3573f4cd476482374b0ac0393153d344338)

3 years agoCVE-2020-28019: Failure to reset function pointer after BDAT error
Jeremy Harris [Thu, 4 Mar 2021 21:19:08 +0000 (22:19 +0100)]
CVE-2020-28019: Failure to reset function pointer after BDAT error

Based on Phil Pennock's commits 4715403e and 151ffd72, and Jeremy
Harris's commits aa171254 and 9aceb5c2.

(cherry picked from commit 0a3fbb7e3be375bc93b8e359c6aff333c7c2d76f)
(cherry picked from commit 99d057fad97a2def9f000ebccda83e4008112819)

3 years agoSECURITY: smtp_out: Leave a clean input buffer, even in case of read error
Heiko Schlittermann (HS12-RIPE) [Wed, 2 Dec 2020 21:28:02 +0000 (22:28 +0100)]
SECURITY: smtp_out: Leave a clean input buffer, even in case of read error

Credits: Qualys

  7/ In src/smtp_out.c, read_response_line(), inblock->ptr is not updated
  when -1 is returned. This does not seem to have bad consequences, but is
  maybe not the intended behavior.

(cherry picked from commit f7ac5a7d1e817bf60f161e7a1d40b65d66da607f)
(cherry picked from commit 13f9998ebb937970d1d9d18f205a6e03e14105b4)

3 years agoSECURITY: Avoid modification of constant data
Heiko Schlittermann (HS12-RIPE) [Thu, 26 Nov 2020 17:16:59 +0000 (18:16 +0100)]
SECURITY: Avoid modification of constant data

Credits: Qualys

    6/ In src/pdkim/pdkim.c, pdkim_update_ctx_bodyhash() is sometimes called
    with a global orig_data and hence canon_data, and the following line can
    therefore modify data that should be constant:

     773   canon_data->len = b->bodylength - b->signed_body_bytes;

    For example, the following proof of concept sets lineending.len to 0
    (this should not be possible):

    (sleep 10; echo 'EHLO test'; sleep 3; echo 'MAIL FROM:<>'; sleep 3; echo 'RCPT TO:postmaster'; sleep 3; echo 'DATA'; date >&2; sleep 30; printf 'DKIM-Signature:a=rsa-sha1;c=simple/simple;l=0\r\n\r\n\r\nXXX\r\n.\r\n'; sleep 30) | nc -n -v 192.168.56.102 25

    (gdb) print lineending
    $1 = {data = 0x55e18035b2ad "\r\n", len = 2}
    (gdb) print &lineending.len
    $3 = (size_t *) 0x55e180385948 <lineending+8>
    (gdb) watch *(size_t *) 0x55e180385948

    Hardware watchpoint 1: *(size_t *) 0x55e180385948
    Old value = 2
    New value = 0
    (gdb) print lineending
    $5 = {data = 0x55e18035b2ad "\r\n", len = 0}

(cherry picked from commit 9fce76f56459dde7489eb21ce1ff822e04e10f43)
(cherry picked from commit 667fb25b8f0dc3fbac57bce4051e345555fa776a)

3 years agoSECURITY: Avoid memory corruption in dkim handling
Heiko Schlittermann (HS12-RIPE) [Wed, 25 Nov 2020 22:19:57 +0000 (23:19 +0100)]
SECURITY: Avoid memory corruption in dkim handling

Credits: Qualys

    6/ In src/pdkim/pdkim.c, pdkim_update_ctx_bodyhash() is sometimes called
    with a global orig_data and hence canon_data, and the following line can
    therefore modify data that should be constant:

     773   canon_data->len = b->bodylength - b->signed_body_bytes;

    For example, the following proof of concept sets lineending.len to 0
    (this should not be possible):

    (sleep 10; echo 'EHLO test'; sleep 3; echo 'MAIL FROM:<>'; sleep 3; echo 'RCPT TO:postmaster'; sleep 3; echo 'DATA'; date >&2; sleep 30; printf 'DKIM-Signature:a=rsa-sha1;c=simple/simple;l=0\r\n\r\n\r\nXXX\r\n.\r\n'; sleep 30) | nc -n -v 192.168.56.102 25

    (gdb) print lineending
    $1 = {data = 0x55e18035b2ad "\r\n", len = 2}
    (gdb) print &lineending.len
    $3 = (size_t *) 0x55e180385948 <lineending+8>
    (gdb) watch *(size_t *) 0x55e180385948

    Hardware watchpoint 1: *(size_t *) 0x55e180385948
    Old value = 2
    New value = 0
    (gdb) print lineending
    $5 = {data = 0x55e18035b2ad "\r\n", len = 0}

(cherry picked from commit ea850e27714ccda2090d781ebe89b410bc38c2c6)
(cherry picked from commit 4e784efa28b25683c81a857b464777df593cabee)

3 years agoSECURITY: Avoid decrement of dkim_collect_input if already at 0
Heiko Schlittermann (HS12-RIPE) [Wed, 25 Nov 2020 21:58:58 +0000 (22:58 +0100)]
SECURITY: Avoid decrement of dkim_collect_input if already at 0

Credits: Qualys

    5/ receive_msg() calls dkim_exim_verify_finish(), which sets
    dkim_collect_input to 0 and calls pdkim_feed_finish(), which calls
    pdkim_header_complete(), which decreases dkim_collect_input to UINT_MAX,
    which reactivates the DKIM code.

    As a result, pdkim_feed() is called again (through receive_getc at the
    end of receive_msg()), but functions like pdkim_finish_bodyhash() and
    exim_sha_finish() have already been called (in pdkim_feed_finish()).
    This suggests a use-after-free.

    But it seems that a use-after-free would happen only with
    EVP_DigestFinal() (in exim_sha_finish()), which does not seem to be
    reachable via DKIM (no SHA3). But we checked OpenSSL only, not GnuTLS.

    Here is a proof of concept that triggers the bug (which came very close
    to a security vulnerability):

    (sleep 10; echo 'EHLO test'; sleep 3; echo 'MAIL FROM:<>'; sleep 3; echo 'RCPT TO:postmaster'; sleep 3; echo 'BDAT 42 LAST'; date >&2; sleep 30; printf 'not a valid header line\r\nDKIM-Signature:\r\nXXX'; sleep 30) | nc -n -v 192.168.56.102 25

    (gdb) print &dkim_collect_input
    $2 = (unsigned int *) 0x55e180386d90 <dkim_collect_input>
    (gdb) watch *(unsigned int *) 0x55e180386d90

    Hardware watchpoint 1: *(unsigned int *) 0x55e180386d90
    Old value = 0
    New value = 4294967295
    #0  0x000055e18031f805 in pdkim_header_complete (ctx=ctx@entry=0x55e181b9e8e0) at pdkim.c:1006
    #1  0x000055e18032106c in pdkim_feed_finish (ctx=0x55e181b9e8e0, return_signatures=0x55e180386d78 <dkim_signatures>, err=err@entry=0x7ffe443e1d00) at pdkim.c:1490
    #2  0x000055e1802a3280 in dkim_exim_verify_finish () at dkim.c:328
    #3  0x000055e1802c9d1d in receive_msg (extract_recip=extract_recip@entry=0) at receive.c:3409

(cherry picked from commit e3674091056ac05eb7ef1c504accce790c434bd7)
(cherry picked from commit 8b39dd074e3ec70cbda70a52cef5b71ecbf69499)

3 years agoSECURITY: Check overrun rcpt_count integer
Heiko Schlittermann (HS12-RIPE) [Wed, 25 Nov 2020 21:26:53 +0000 (22:26 +0100)]
SECURITY: Check overrun rcpt_count integer

Credits: Qualys

    4/ In src/smtp_in.c:

    4966     case RCPT_CMD:
    4967       HAD(SCH_RCPT);
    4968       rcpt_count++;
    ....
    5123       if (rcpt_count > recipients_max && recipients_max > 0)

    In theory this recipients_max check can be bypassed, because the int
    rcpt_count can overflow (become negative). In practice this would either
    consume too much memory or generate too much network traffic, but maybe
    it should be fixed anyway.

(cherry picked from commit 04139ca809fbe56d8fe9c55a77640ea9fa93b8f1)
(cherry picked from commit db96ca55137d7684a9afdf9d118feed9116906b7)

3 years agoSECURITY: Fix safeguard against upward traversal in msglog files.
Heiko Schlittermann (HS12-RIPE) [Sat, 21 Nov 2020 21:41:28 +0000 (22:41 +0100)]
SECURITY: Fix safeguard against upward traversal in msglog files.

Credits: Qualys

    3/ In src/deliver.c:

     333 static int
     334 open_msglog_file(uschar *filename, int mode, uschar **error)
     335 {
     336 if (Ustrstr(filename, US"/../"))
     337   log_write(0, LOG_MAIN|LOG_PANIC,
     338     "Attempt to open msglog file path with upward-traversal: '%s'\n", filename);

    Should this be LOG_PANIC_DIE instead of LOG_PANIC? Right now it will log
    the /../ attempt but will open the file anyway.

(cherry picked from commit 742c27f02d83792937dcb1719b380d3dde6228bf)
(cherry picked from commit 1e9a340c05d7233969637095a8a6378b14de2976)

3 years agoSECURITY: Don't miss the very last byte when reading long lines from -H
Heiko Schlittermann (HS12-RIPE) [Sat, 21 Nov 2020 21:18:56 +0000 (22:18 +0100)]
SECURITY: Don't miss the very last byte when reading long lines from -H

Credits: Qualys

    2/ In src/spool_in.c:

     462   while (  (len = Ustrlen(big_buffer)) == big_buffer_size-1
     463         && big_buffer[len-1] != '\n'
     464         )
     465     {   /* buffer not big enough for line; certs make this possible */
     466     uschar * buf;
     467     if (big_buffer_size >= BIG_BUFFER_SIZE*4) goto SPOOL_READ_ERROR;
     468     buf = store_get_perm(big_buffer_size *= 2, FALSE);
     469     memcpy(buf, big_buffer, --len);

    The --len in memcpy() chops off a useful byte (we know for sure that
    big_buffer[len-1] is not a '\n' because we entered the while loop).

(cherry picked from commit 58454ea01c2e817481770954edf09ad82f3cd417)
(cherry picked from commit 2d9f1837bdd6c5946cb9cd997544eefc8cc14fc4)

3 years agoSECURITY: off-by-one in smtp transport (read response)
Heiko Schlittermann (HS12-RIPE) [Sat, 21 Nov 2020 21:03:03 +0000 (22:03 +0100)]
SECURITY: off-by-one in smtp transport (read response)

Credits: Qualys

    1/ In src/transports/smtp.c:

    2281       int n = sizeof(sx->buffer);
    2282       uschar * rsp = sx->buffer;
    2283
    2284       if (sx->esmtp_sent && (n = Ustrlen(sx->buffer)) < sizeof(sx->buffer)/2)
    2285         { rsp = sx->buffer + n + 1; n = sizeof(sx->buffer) - n; }

    This should probably be either:

    rsp = sx->buffer + n + 1; n = sizeof(sx->buffer) - n - 1;

    or:

    rsp = sx->buffer + n; n = sizeof(sx->buffer) - n;

    (not sure which) to avoid an off-by-one.

(cherry picked from commit d2c44ef5dd94f1f43ba1d1a02bc4594f4fba5e38)
(cherry picked from commit 4045cb01a590ec480f45f80967cd9c59fe23a5d0)

3 years agoStart documenting the things we changed incompatibly.
Phil Pennock [Mon, 2 Nov 2020 07:39:38 +0000 (02:39 -0500)]
Start documenting the things we changed incompatibly.

(cherry picked from commit 8dad4da53bad2ed3b29fa6a3b9ef59bfec73dc0e)
(cherry picked from commit 125f0d4afbc858cf514c29326a3016c2d9d7bdc1)

3 years agoInline four often-called new functions
Phil Pennock [Mon, 2 Nov 2020 07:23:14 +0000 (02:23 -0500)]
Inline four often-called new functions

The BDAT state switchers should happen so often during SMTP reception that a
compiler hint to inline seems wise.

The length filter checks happen on every start-up, which for Exim is often
enough that I think an inline these is warranted too.

(cherry picked from commit 6e3d0e3f1c8228ef19a3d1ba61f131cef3172ceb)
(cherry picked from commit 6ca5fcba34070f4495a0188f16eb2e4d78f3430a)

3 years agoFixes for compilation
Jeremy Harris [Sat, 31 Oct 2020 14:36:55 +0000 (14:36 +0000)]
Fixes for compilation

(cherry picked from commit 85a90771a373aaaced64b92d7176a8a310490b9e)
(cherry picked from commit da683a61556bbbebdffcbebf2668da58da59f898)

3 years agoSECURITY: rework BDAT receive function handling
Phil Pennock [Fri, 30 Oct 2020 03:21:36 +0000 (23:21 -0400)]
SECURITY: rework BDAT receive function handling

(cherry picked from commit dd1b9b753bb7c42df2b8f48d726b82928b67940b)
(cherry picked from commit 96fb195ebc2eb6790e6ad6dde46d478aee62198d)

3 years agoSECURITY: fix SMTP verb option parsing
Phil Pennock [Fri, 30 Oct 2020 02:40:59 +0000 (22:40 -0400)]
SECURITY: fix SMTP verb option parsing

A boundary case in looking for an opening quote before the closing quote could
walk off the front of the buffer.

(cherry picked from commit 515d8d43a18481d23d7cf410b8dc71b4e254ebb8)
(cherry picked from commit 467948de0c407bd2bbc2e84abbbf09f35b035538)

3 years agoSECURITY: Avoid integer overflow on too many recipients
Phil Pennock [Fri, 30 Oct 2020 01:48:05 +0000 (21:48 -0400)]
SECURITY: Avoid integer overflow on too many recipients

(cherry picked from commit 323ff55e67b44e95f9d3cfaba155e385aa33c4bd)
(cherry picked from commit 3a54fcd1e303bf1cc49beca7ceac35d7448860a9)

3 years agoSECURITY: default recipients_max to 50,000
Phil Pennock [Fri, 30 Oct 2020 01:38:25 +0000 (21:38 -0400)]
SECURITY: default recipients_max to 50,000

A default of "unlimited" can have unfortunate consequences when people start
putting many millions of recipients on a message.

(cherry picked from commit 1d7780722a66cea8da5fa4ae0775e85d185fbf7e)
(cherry picked from commit a6e1f69d82adcfd3caab8f228d96750dfddc8f07)

3 years agoSECURITY: a second negative store guard
Phil Pennock [Fri, 30 Oct 2020 01:30:04 +0000 (21:30 -0400)]
SECURITY: a second negative store guard

(cherry picked from commit 706864e934c70941ce7a327f97b7649a1e5f5556)
(cherry picked from commit 9f06dcd6848052f2524658bf871c60a8d48c7dbe)

3 years agoSECURITY: refuse too small store allocations
Phil Pennock [Fri, 30 Oct 2020 00:49:49 +0000 (20:49 -0400)]
SECURITY: refuse too small store allocations

Negative sizes are definitely bad.
Optimistically, I'm saying that zero is bad too.  But perhaps we have something
doing that, expecting to be able to grow.  In which case we'll have to amend
this.

(cherry picked from commit 1c9afcec0043e2fb72607b2addb0613763705549)
(cherry picked from commit 6f5d7e5af8eff688c36f81334e4f063689561963)

3 years agoSECURITY: fix Qualys CVE-2020-PFPZA
Phil Pennock [Fri, 30 Oct 2020 00:42:40 +0000 (20:42 -0400)]
SECURITY: fix Qualys CVE-2020-PFPZA

(cherry picked from commit 29d7a8c25f182c91d5d30f124f9e296dce5c018e)
(cherry picked from commit 0a6a7a3fd8464bae9ce0cf889e8eeb0bf0bab756)

3 years agoSECURITY: fix Qualys CVE-2020-PFPSN
Phil Pennock [Thu, 29 Oct 2020 23:00:51 +0000 (19:00 -0400)]
SECURITY: fix Qualys CVE-2020-PFPSN

(cherry picked from commit 93b6044e1636404f3463f3e1113098742e295542)
(cherry picked from commit 4e59a5d5c448e1fcdcbead268ffe6561adf0224d)

3 years agoSECURITY: fix Qualys CVE-2020-SLCWD
Phil Pennock [Thu, 29 Oct 2020 15:47:58 +0000 (11:47 -0400)]
SECURITY: fix Qualys CVE-2020-SLCWD

(cherry picked from commit bf5f9d56fadf9be8d947f141d31f7e0e8fa63762)
(cherry picked from commit 6d2cfb575c95c1b81597d6b9eb2904cd695d7e4a)

3 years agoSECURITY: pick up more argv length checks
Phil Pennock [Thu, 29 Oct 2020 22:40:37 +0000 (18:40 -0400)]
SECURITY: pick up more argv length checks

(cherry picked from commit f28a6a502c7973d8844d11d4b0990d4b0359fb3f)
(cherry picked from commit 7a7136ba7f5c2db33c7e320ffd4675335c4557e5)